Posted
by
samzenpus
on Thursday August 30, 2012 @07:16PM
from the patch-it-up dept.

First time accepted submitter JavaBear writes "Oracle have just released the u7 release of their Java 7. From the article: 'In response to the findings of a recent vulnerability in Java 7 that was being exploited by malware developers, Oracle has released an official patch that takes care of the problem.
In the past week, a new vulnerability was unveiled in Oracle's Java 7 runtime, which has been used by hackers in targeted attacks on Windows-based systems. Similar to the recent Flashback malware in OS X, this vulnerability allows criminals to create a drive-by hack where the only action needed to compromise a system is to visit a rogue Web page that hosts a malicious Java applet."

Which is fair given that they hadn't really said much about it until this point. It's possible this is actually oracle policy, it's possible the press made them change or break policy. Everyone had understood their policy to be 'no out of cycle patch', and waiting until Oct 26, that's why a bunch of people came up with a hack patch for it, that's why the press was all over this.

Some of this might just be Oracle not being used to dealing with end users, and they really do out of cycle patches for serious exploits etc. and they just did a shitty job of conveying that. It's also possible Larry got exploited while looking at porn and beat up a minion to make him fix it.

I have to deal with Oracle every day. They operate much like a company that I used to work for... ATT. ATT is so large, so ubiquitous, their profits so untouchable, that they just don't give a shit anymore. They don't need to. To address a problem, ATT creates a new department, at the expense of millions of dollars. Often that new department does something as trivial as copy data from one system to another. Hiring a team of 10 people to do manual data entry all day every day is easier/cheaper than paying developers to do it right.

Knowing what I know of Oracle, I'm sure that the "Mal-ware investigatory department" sent in form 24b-FF with a priority level 3 as soon as they knew about the issue. That form was received by a "Critical patch program director" who then scheduled the appropriate conference calls and meetings to discuss who would head up, design, testing, implementation, cost projections, etc... Once the team was assembled 2hr meetings with catered lunch were scheduled daily to discuss progress and adjusted cost projections. Now that the patch has been released, they will enter a post patch analysis of self aggrandizing back patting.

You can't get rid of Oracle. They are the ATT of Databases. Everyone is stuck with them, they know it, we just have to bend over and hope they use lube.

The default in Java is to check for an update every month. If you want to reduce your exposure to "30-day" exploits, it would be wise to go into the Java control panel applet and increase the update check frequency to monthly or daily if you must use Java. "Update Now" is available on the update tab of the control panel applet if you don't want to download this update from the web.

I killed Java 7 on Monday at my work. I won't bring it back any time soon. Oracle, in case you care this is how you messed this up royally:

1. You sat on this since April.2. Exploits have been in the wild since last weekend and you didn't even acknowledge it until today.3. The community was left to fend for themselves, and the only way to fend for themselves was to/remove/ your product.

This is how you should have had handled this:1. You should have patched this during your normal patch release cycle that you had since April.2. You should have immediately acknowledged the exploit.3. You should have immediately acknowledged the breadth of the exploit.4. A very simple note on your blog to the affect of "were working on this, expect something shortly" would have made all the difference.

As a result of your failure to take security half as seriously as Microsoft (I never could have imagined I would say that 10 years ago), I spent the first have of my week testing an emergency uninstall package of Java for multiple platforms. After getting it approved through an ECAB and rushing it into production - since I had no idea when you were going to release a patch I uninstalled Java 7 system wide at a very large institution this week.

After my emergency uninstall went into production it came up in a meeting with management today that an out of band patch got released today. At this point my response to management was simple, "too late". No one questioned my decision and Java 7 is now gone.

If your company didn't need Java to interact with internal or client/vendor/etc websites, you probably shouldn't have it installed in the first place.Firewalls and antivirus scanners are nice, but reducing the attack surface is better.

Hopefully those users with local admin rights also have some form of managed AV software. Norton, Trend Micro, Vipre, anything that will report back to a central server with full logging of malware hits. I actually called one of the owners of of a company over to my computer and showed him the logs of two laptop users that have systemically been abusing their rights. That ended that crap in a hurry:)

Not to mention that an uninstall wasn't necessary to mitigate the risk.

But it worked just fine.

I avoid Oracle applications whenever I can because of how they treat their customers. This includes open source where the copyrights are held by Oracle, or the main development effort is under Oracle. So I avoid java, mysql, berkeley db, openoffice, virtualbox and zfs.

No, Libreoffice was forked from Openoffice.org after Oracle took it over, and to my knowledge, no effort has been taken to excise the open source code to which Oracle or at-the-time Oracle employees hold the copyrights.It also requires Java for some of the components, which is another blocker.

As a sysadmin, you need to have a means to both silently install as remove software. The fact you state you spent half your week testing an emergency uninstall package of Java for multiple platforms indicates you did not have an upgrade path in place. Upgrading java requires removing the old version *unless* you need to keep a an older version for compatibility reasons, *in which case* you just simply cannot uninstall java and say to your management 'Too late':-) . So Oracle is not the only one m

My normal Java upgrade packages first uninstall old versions of Java. Officially we only ran Java 6 to begin with, however we had a number of users who have admin privelages for political reasons and so we had to get all of the uninstall strings for Java 7 and test them on several platforms and test them on our management platform.

My irritation with Java is twofold. First it is very high maintenance and secondhand is that Oracle completely dropped the ball on communications with this.

Coincidentally Java 6 update 35 was also released at the same time. The release notes cite a security fix. All CVE [nist.gov] entries and info I could find only describe this issue as a Java 7 vulnerability. I had not see any confirmation yet that it also applied to Java 6 other than the brand new update [oracle.com].

I don't really see the need for applets any more as a load if present part of the page. The last one I ran was for Nvidia and all it did was detect which driver I needed. Chrome didn't have Java installed since it was a fresh install, but even after installing it chrome asked nicely if I wanted to run the plugin. Back in the day when people thought they could use applets the way they use flash auto loading was needed, but now that part failed why not just go to a load on request only. At least that way t

My understanding is... no. HTML5 and plain old JavaScript should replace or supercede pretty much anything an Applet can do. I think there still could be a place for Java WebStart, but I'm concerned for JavaFX in light of HTML5 as well. JavaFX seems just too late to the game. Like Java's eventual answer to Adobe Flash and Microsoft Silverlight just in time to surrender to HTML5. Then again, this is in terms of using JavaFX in the web tier, you can still write native apps, like games, with JavaFX for ha

The thing on my mind is, how much does Oracle earn with a patch release. The ask toolbar crapware is installed by default and people hitting "next next next" will be infected. Only by installing this with care you will not get the ask toolbar.
I know they are not alone in this (adobe wants to install the crome browser as default AND the google toolbar for IE, talk about redundancy) but they incorporate it in all updates..